AFFECT, grrr. Not effect. To effect every coder would be to bring them all into existence, which is clearly not what happened here.
GitHub and Rails: You have let us all down.
11–20 of 205 posts
Re: GitHub and Rails: You have let us all down.
#12> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you…
People use services like GitHub because they provide security, reliability, uptime, protection against hw failure, centralized issues and patches, and so on. If we have to worry about each of these on our pwn, what's the point?
Re: GitHub and Rails: You have let us all down.
#13Give me an F'in break. I understand security is not something to take lightly, but no system is infallible. There was an oversight, plain and simple. It is debatable whether the Github/Rails Core Team was too lax, but I for one am tired of hearing developers whine and make a witch trial out of groups of developers that have moved the development community forward several huge steps just to make themselves sound smart or feel fulfilled. If you're such a hero, why didn't you discover this loophole? Please stop writing provocative statements and behaving as if the sky is falling on top of your head and the very fiber of our being is at stake. An open source language and a website written in that language were shown to have a flaw. Which has since been fixed. I hate developers who like to sound smart at the expense of somebody else. Get over yourself.
I also don't see how you can blast Github for its oversight of this issue but then defend the "hundreds of thousands" of sites that use Rails. Aren't they as culpable? Oh, I suppose Github is held to a higher standard than the rest of the dependent apps. If this is Github's fault, then it is also every other developer's fault who doesn't by default disable mass-assignment of attributes.
Re: GitHub and Rails: You have let us all down.
#14I'm not sure all the things you list as being possible are true. - Every GitHub Repository could be access by anyone as if they had full administrator privileges. - This means that anyone could commit to master. - This means that anyone could reopen and close issues in issue tracker. - Even the *entire* history of a project could be wiped out. Gone forever. As I understand it from his explanation[1] he added his publ…
FWIW, that last bullet, aside from being the most egregious example of hyperbole in TFA, shows a complete lack of understanding of how git works.
Nothing in the article would lead one to believe he didn't understand the distributed nature of git repositories, but a lot in the article would lead one to believe he was specifically referring to the data loss issues on GitHub if someone wiped out a project.
Re: GitHub and Rails: You have let us all down.
#15I fail to see what GitHub did wrong here. They were attacked, they suspended the account doing the hacking, and they fixed the problem. Then, they blogged about it, explaining in detail what happened. Apparently they weren't quite reverent enough for the person who wrote this article.
[deleted]
Re: GitHub and Rails: You have let us all down.
#16> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you…
I don't think anyone is dreadfully concerned about service availability - although that is certainly a concern.
The problem is that source code is incredibly valuable and often represents many man-years of effort. A competitor could use this to bypass a lot of the early architectural fumbling around that we all do. Also, source code often contains passwords and shared secrets like Facebook secret keys. Disclosure wouldn't be the end of the world, but it could certainly be disastrous for a lot of companies.
Re: GitHub and Rails: You have let us all down.
#17> When the large portion of the technical world all depends on a single service, and that service is vulnerable to a variety of attacks, that makes anyone who consumes these services also vulnerable. I don't mean to diminish the severity of this exploit, and the impact it has/could have had if left unchecked. BUT, isn't one of the biggest perks of Git the fact that it's a distributed SCM? It's not a service where you…
People use services like GitHub because they provide security, reliability, uptime, protection against hw failure, centralized issues and patches, and so on. If we have to worry about each of these on our pwn, what's the point?
> If we have to worry about each of these on our pwn, what's the point?
You should always have to worry about these things, regardless of who's hosting things. It just so happens that Github, to date, has been checking the boxes in these areas and has established a reputation for doing so.
But, if GitHub losing your repo/having it trashed beyond repair will kill your project (or severely hamper it), the cost of setting up a second Git server and a couple of hooks to mirror your push is very low, in both dollars and man-hours.
Re: GitHub and Rails: You have let us all down.
#18Give me an F'in break. I understand security is not something to take lightly, but no system is infallible. There was an oversight, plain and simple. It is debatable whether the Github/Rails Core Team was too lax, but I for one am tired of hearing developers whine and make a witch trial out of groups of developers that have moved the development community forward several huge steps just to make themselves sound smart…
It's not a flaw, because the flaw in this case was a feature! That's what we call "insecure by design". Its PHPs register_globals all over again.
Re: GitHub and Rails: You have let us all down.
#19I fail to see what GitHub did wrong here. They were attacked, they suspended the account doing the hacking, and they fixed the problem. Then, they blogged about it, explaining in detail what happened. Apparently they weren't quite reverent enough for the person who wrote this article.
I lost a tremendous amount of respect for Github when I heard they'd suspended his account.
I have more of an issue with the Rails team for not accepting that this "feature" is a massive bug that they should've changed ages ago, though.
Re: GitHub and Rails: You have let us all down.
#20Give me an F'in break. I understand security is not something to take lightly, but no system is infallible. There was an oversight, plain and simple. It is debatable whether the Github/Rails Core Team was too lax, but I for one am tired of hearing developers whine and make a witch trial out of groups of developers that have moved the development community forward several huge steps just to make themselves sound smart…
You're conflating two issues here. He's arguing that the Rails team was ignoring an important issue by noting it was an easy end-user fix, and GitHub overreacted by suspending him after he tried several times to bring it to their attention, and then grossly mislead their user base as to the extent of the issue (which sounds like a really fundamental security issue that any professional Rails developer should know how to avoid) and how they discovered it (i.e. they didn't discover it, they had to be shown it). You're responding as if GitHub was simply being attacked for not fixing the issue.